Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

-1
votes
0answers
31 views

*push-apple.com.akadns.net Pushing Malware to IOS & Mac?

Bear in mind it looks like Apple Push Notification Service is a gateway for pushing viruses and malware to users devices, if I am not mistaken, just look here: https://www.virustotal.com/gui/ip-...
0
votes
1answer
63 views

Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?

Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
1
vote
4answers
94 views

The safest way to transfer files to an offline test environment

I'm wondering what the best tactic is to transfer dangerous files from an internet connected machine to an offline, separated from the web, virtual machine. Why should I do that? Because I want to ...
2
votes
0answers
74 views
+50

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
1
vote
0answers
12 views

When Google removes malicious apps from their Play Store, are users notified? [migrated]

This Check Point Research article describes over 200 malicious apps on the Google Play Store that were downloaded over 100 million times. Google has now removed the apps from their Play Store. But ...
0
votes
1answer
89 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
1
vote
1answer
67 views

How did antivirus vendors find malware to include in traditional AV signatures?

Forgive me if it's a silly question, but I'm genuinely curious. How do traditional AV (signature-based only) vendors get the malware to analyse and include in definition files? Also, what's the ...
2
votes
0answers
37 views

Eventviewer empty logs with English written in Cyrillic Greek

So a while ago I entered my event viewer on windows 10 and I noticed a bunch of weird entries. They look like they where written in English but with the use of Cyrillic and Greek alphabets. I am ...
3
votes
2answers
106 views

Watching movie from a potentially infected device

I went on holiday with a friend. He filmed and made a movie from our trip. He put the movie on my usb key. I was about to plug this, but realised my friend does not have good security practices, so ...
2
votes
2answers
158 views

Are most warez malicious?

There are many big torrent uploaders, some marked as 'VIP' or 'Trusted' and whatnot with many seeders and good reviews. How likely is it that their software is malicious with some kind of evasive ...
0
votes
1answer
104 views

Random Chrome Notifications and Strange Source Code

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443) Example Messages • Pending Payment: Paypal Has Sent You $65,900 • Clean your mac....
1
vote
1answer
730 views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
2
votes
1answer
110 views

Possible Phishing Attempt?

I ran into a strange situation today. I use an iPhone. Today I got a text from an unknown number starting from +65. The message was that your one time Wifi password is xxxx and it’s valid for only 10 ...
1
vote
0answers
35 views

Receiving constant TX RX from Amazon servers upon router restart and ensues [closed]

I had reason to believe my computer was compromised so I used Wireshark and found out that upon restarting my router and before router opens ports with internet provider it systematically tries to ...
0
votes
0answers
16 views

Is VMWare workstation really safe? [duplicate]

I want to try to run some malwares in VMWare and I am a little bit afraid. Is it really safe? Is there any option that malware can get into my main PC?
0
votes
0answers
4 views

Is my webcam hardwired? [migrated]

I want to know if my webcam LED can be controlled by software (malware) or if it is hardwired. My understanding is that if a webcam's LED is hardwired it cannot be turned on by a hacker without the ...
2
votes
0answers
30 views

Isolate Virtual Machines on host-only adapter- Malware Analysis

I am performing malware analysis on virtual box. I want only the VMs to communicate to each other. Using host-only adapters, I have installed a Windows7 VM (192.168.56.101) with default gateway (192....
0
votes
2answers
81 views

What are some examples of known scenarios of network attacks?

For example, it is possible that someone could spread malware with insecure wifi access point, but I don't realize how sending a bunch of network packets can result into a compromised computer if the ...
2
votes
1answer
83 views

What features would you use to detect a backdoor or a bot installation?

I was reading a document about logging and analysis. The document talks about statistical analysis and machine learning techniques to detect some attack scenarios. For instance, If you want to detect ...
0
votes
1answer
94 views

Triaging malicious URLs

I'm quite new to the security field and learning my ways on how to triage certain events. One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if ...
1
vote
2answers
129 views

Does 2-Factor Authentication protect against malware?

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does: Every time you login to ...
-3
votes
1answer
88 views

Bank sites are protected by their own adblocking software

I do not currently have any adblocking software or extension. Ads are flourishing on foxnews and some other sites but not on my banks page. Do banks use some their own addblocking software?
0
votes
0answers
100 views

How do I satisfy a requirement to scan text files for malware?

We have a requirement (on our closed network) to scan any file(s) introduced on the system for content that will do something "bad". (Bad is not the exact wording, just the intent.) This started when ...
86
votes
5answers
23k views

Can a malware power on a computer?

I've just downloaded and executed a piece of malware on my computer. I don't have much time right now, so I just powered it off (turned it off via the Start menu), hoping that it won't be able to ...
0
votes
1answer
82 views

How to analyze and track what data a software sends?

How can i track which program sends data over my network and can i see the contents of it? If we have a AV software installed in a VM , can we see what it's sending from your pc when doing a scan?
1
vote
0answers
50 views

How is someone accessing my google account? [closed]

Two weeks ago I got a notice from Amazon that there was a suspicious charge on my account. My Amazon password is randomly generated, and not used anywhere else so my assumption was my Google Account ...
3
votes
1answer
97 views

Why must Meltdown use probe array?

This is code snippet of Meltdown assembly language code: 1. ; rcx = kernel address, rbx = probe array 2. xor rax, rax 3. retry: 4. mov al, byte [rcx] 5. shl rax, 0xc 6. jz retry 7. mov rbx, ...
0
votes
1answer
104 views

Can I detect malware download using Wireshark?

I have been working on Wireshark lately. I am learning about malware behavior, but I am curious to know whether methods exist to detect malware download (via drive-by download) on systems. Anti-...
0
votes
2answers
129 views

Determine if helloworld.msi is malicious

Recently, while checking the windows application logs, I found that an application communicates with a certain website. The process starts and ends in about a minute. It does not appear in my search ...
0
votes
0answers
40 views

Is MISP enhancing the accuary of Cuckoo Sandboxs score and raised signatures of an analysis?

My current setup of Cuckoo is that Cuckoo is scanning attachments of emails in an automated way using PeekabooAV. Based on the score of the analysis that Cuckoo gave and the raised signatures the ...
0
votes
1answer
43 views

Virtual machines vs separate physical machines for testing potential malware

If you have to run potentially insecure executables, would using a separate laptop have any security benefit compared to a virtual machine, or would it be worse in the sense that the machine's ...
1
vote
1answer
85 views

Will removing the harddrive from a computer protect it from persistent malware?

If I took a clean computer/laptop and removed the harddrive, lock the BIOS with a password, then did all my work from a live OS like Knoppix, will this help reduce the risk of persistent malware ...
0
votes
2answers
76 views

Reasons why different antivirus engines detect same malware differently

I think I understand how does signature-based detection work (calculate hash -> compare it with the database of hashes), but I can't understand why some AV engines find the same virus as different. ...
3
votes
1answer
151 views

Is storing information in RAM more secure than on Disk?

I realize neither is foolproof, of course. I would just like to confirm my thought that it's harder for an attacker to get a memory dump than to copy from disk/flash-storage or that malware just tends ...
1
vote
1answer
170 views

PDF UrlMal-inf[Trj] Virus

When I create PDF file from my particular DOCX file, it gets infected with the virus. But if I create a new DOCX file and create PDF from that, it doesn't get infected with the virus. I have tried ...
2
votes
3answers
181 views

Malware Analysis

What would be a good approach for testing malware or bad url's from things picked up from my SIEM to validate them? I was told to setup a VM for these tests but don't want it to hit the internal ...
0
votes
0answers
26 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
146
votes
20answers
38k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
-1
votes
1answer
42 views

How does an antivirus flag homemade malware? [duplicate]

Say I made some malware in python or c# or whatever language, How would an antivirus detect that the program has malicious intent because how does the antivirus know that the program is malicious ...
2
votes
1answer
106 views

Why did Stuxnet have command and control servers?

I am currently reading Countdown to Zero Day which, amongst other things, describes Stuxnet in lay terms. It states that Stuxnet could report to two command and control servers. Most basic ...
0
votes
1answer
113 views

badBIOS reflashing

This is not a has-badBIOS-pwn3d-me post, so don't worry about any paranoid rants. Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS ...
1
vote
0answers
53 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
0
votes
0answers
28 views

What are the steps of making a fully undetectable piece of malware? [duplicate]

I've been recently taught how antiviruses work. I know that there is more to it but they basically have a list of known malware that they have encountered and every time they scan, they check if their ...
2
votes
2answers
87 views

Security and thumb drive [duplicate]

If my laptop is locked, can a thumb drive be able to still infect my computer, or create a backdoor, or any other security risk if it's plugged into it. If so what are some example
1
vote
3answers
1k views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
2
votes
2answers
99 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
0
votes
2answers
653 views

A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]

I have found this question below but I need some more clarification that's why I am writing again. I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is ...
1
vote
1answer
100 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
0
votes
1answer
93 views

How are victims targeted from outer networks (WAN)

I started getting more interested about security about one year ago, and from all the things I have learned up to this day I never knew how particular victims are targeted from the attackers from ...
3
votes
3answers
74 views

Why does VirusTotal have two different reports for the same hash depending on FILE vs URL submission?

Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time? Submitting a file to VirusTotal via File upload results in numerous hits for malware. ...